基于溯因学习的无监督网络流量异常检测  

Unsupervised Network Traffic Anomaly Detection Based on Abductive Learning

作　　者：胡文涛 徐靖凯 丁伟杰[1] HU Wentao;XU Jingkai;DING Weijie(Department of Computer and Information Security,Zhejiang Police College,Hangzhou 310053,China)

机构地区：[1]浙江警察学院计算机与信息安全系,杭州310053

出　　处：《信息网络安全》2024年第11期1675-1684,共10页Netinfo Security

基　　金：2024年度浙江省教育科学规划课题(2024SCG316)。

摘　　要：当前计算机网络流量异常检测面临缺乏标注信息的挑战,同时用户需要自行选择合适的技术并调整参数,但没有标签可用于交叉验证。为此,文章提出一种基于溯因学习的无监督网络流量异常检测(ABL-ATD)模型。该模型通过自动生成伪标签,并利用演绎与一致性验证生成高质量标签,避免人工干预。ABL-ATD从多种无监督异常检测模型中提取有效信号,并通过验证与修正,可靠区分异常流量和正常流量。实验结果表明,该模型在多个数据集上展现出与使用真实标签训练的监督学习模型相当的准确性。The current challenge in computer network traffic anomaly detection is the lack of labeled information,while users must select appropriate technologies and adjust parameters without any labels for cross-validation.To address this issue,this paper proposed an abductive learning-based anomaly traffic detection(ABL-ATD)model,which operated in an unsupervised manner.This model automatically generated pseudo-labels and utilized deductive reasoning and consistency verification to produce high-quality labels,thereby avoiding manual intervention.The innovation of ABL-ATD lied in its ability to extract effective signals from multiple unsupervised anomaly detection models and reliably distinguish between anomalous and normal traffic through validation and correction.Experimental results demonstrate that this model exhibits accuracy comparable to that of supervised learning models trained with real labels across multiple datasets.

关 键 词：异常流量检测 无监督学习 溯因学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]